cnvd - cnvd-2017-36170

cnvd-2017-36170

Vulnerability from cnvd

Title: McAfee Network Data Loss Prevention跨站脚本漏洞（CNVD-2017-36170）

Description:

McAfee Network Data Loss Prevention（NDLP）是美国McAfee公司的一套网络数据丢失防护软件。该软件能够防止无意或恶意泄露客户数据、员工信息和知识产权信息，以及未授权传输信息。

McAfee NDLP 9.3.x版本中存在跨站脚本漏洞。远程攻击者可通过实施跨站请求伪造攻击利用该漏洞查看保密信息。

Severity: 中

Patch Name: McAfee Network Data Loss Prevention跨站脚本漏洞（CNVD-2017-36170）的补丁

Patch Description:

McAfee NDLP 9.3.x版本中存在跨站脚本漏洞。远程攻击者可通过实施跨站请求伪造攻击利用该漏洞查看保密信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://kc.mcafee.com/corporate/index?page=content&id=SB10198

Reference: http://www.securityfocus.com/bid/101628

Impacted products

Name
McAfee Network Data Loss Prevention 9.3.x

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "101628"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3933"
    }
  },
  "description": "McAfee Network Data Loss Prevention\uff08NDLP\uff09\u662f\u7f8e\u56fdMcAfee\u516c\u53f8\u7684\u4e00\u5957\u7f51\u7edc\u6570\u636e\u4e22\u5931\u9632\u62a4\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u80fd\u591f\u9632\u6b62\u65e0\u610f\u6216\u6076\u610f\u6cc4\u9732\u5ba2\u6237\u6570\u636e\u3001\u5458\u5de5\u4fe1\u606f\u548c\u77e5\u8bc6\u4ea7\u6743\u4fe1\u606f\uff0c\u4ee5\u53ca\u672a\u6388\u6743\u4f20\u8f93\u4fe1\u606f\u3002\r\n\r\nMcAfee NDLP 9.3.x\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5b9e\u65bd\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u653b\u51fb\u5229\u7528\u8be5\u6f0f\u6d1e\u67e5\u770b\u4fdd\u5bc6\u4fe1\u606f\u3002",
  "discovererName": "State Bank Of India",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10198",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-36170",
  "openTime": "2017-12-05",
  "patchDescription": "McAfee Network Data Loss Prevention\uff08NDLP\uff09\u662f\u7f8e\u56fdMcAfee\u516c\u53f8\u7684\u4e00\u5957\u7f51\u7edc\u6570\u636e\u4e22\u5931\u9632\u62a4\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u80fd\u591f\u9632\u6b62\u65e0\u610f\u6216\u6076\u610f\u6cc4\u9732\u5ba2\u6237\u6570\u636e\u3001\u5458\u5de5\u4fe1\u606f\u548c\u77e5\u8bc6\u4ea7\u6743\u4fe1\u606f\uff0c\u4ee5\u53ca\u672a\u6388\u6743\u4f20\u8f93\u4fe1\u606f\u3002\r\n\r\nMcAfee NDLP 9.3.x\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5b9e\u65bd\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u653b\u51fb\u5229\u7528\u8be5\u6f0f\u6d1e\u67e5\u770b\u4fdd\u5bc6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "McAfee Network Data Loss Prevention\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2017-36170\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "McAfee Network Data Loss Prevention 9.3.x"
  },
  "referenceLink": "http://www.securityfocus.com/bid/101628",
  "serverity": "\u4e2d",
  "submitTime": "2017-11-01",
  "title": "McAfee Network Data Loss Prevention\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2017-36170\uff09"
}

CVE-2017-3933 (GCVE-0-2017-3933)

Vulnerability from cvelistv5

Published

2017-10-31 14:00

Modified

2024-09-17 03:22

Severity ?

CWE

Embedding Script (XSS) in HTTP Headers vulnerability

Summary

Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/101628	vdb-entry, x_refsource_BID
	https://kc.mcafee.com/corporate/index?page=content&id=SB10198	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	McAfee	Network Data Loss Prevention	Version: 9.3.X

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:41.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "101628",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101628"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10198"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Network Data Loss Prevention",
          "vendor": "McAfee",
          "versions": [
            {
              "status": "affected",
              "version": "9.3.X"
            }
          ]
        }
      ],
      "datePublic": "2017-09-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Embedding Script (XSS) in HTTP Headers vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-01T09:57:01",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "101628",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101628"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10198"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "DATE_PUBLIC": "2017-09-14T00:00:00",
          "ID": "CVE-2017-3933",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Network Data Loss Prevention",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.3.X"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "McAfee"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Embedding Script (XSS) in HTTP Headers vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "101628",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101628"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10198",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10198"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2017-3933",
    "datePublished": "2017-10-31T14:00:00Z",
    "dateReserved": "2016-12-26T00:00:00",
    "dateUpdated": "2024-09-17T03:22:22.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted